# REPORT — v0.320.0: FileBrowser is part of the box again, every app says where its login is, a „Fájlok" button (2026-10-16)

Written in ASD-STE100 Simplified Technical English. Task: „logins and folders" (operator brief). The full report, with
the decisions taken, the browser check and the rows: felhom.eu `REPORT-logins-folders-2026-10-16.md`. Design read
first: felhom.eu `architecture/02-controller-module-map.md` „The app page" (now with „Logins and folders").
Evidence: felhom.eu `documentation/audits/logins-folders-2026-10-16/`.

## 1. Plain words first

- **Why FileBrowser showed „Telepítés":** it has no app.yaml, so the box marks it not deployed. Since v0.315.0 the app
  page read only that mark. Now a protected infra stack is installed by definition on the app page. Its login is back.
- **The Install press could have installed the infra stack as an app** (no guard). Refused now, in the API and in
  `DeployStack`.
- **„Új jelszó beállítása":** when the box does not know FileBrowser's password, one press sets a new one with
  FileBrowser's own CLI (server stopped ~3 s), verifies it, and stores it encrypted. Pressed on demo-hp: it works.
- **Every installed app has „Belépés az alkalmazásba" with one answer;** the catalog's new `app_info.login_kind` picks
  the sentence when the box holds no login.
- **„Fájlok ↗"** opens one folder of the app in FileBrowser; the data tab lists each drive's media folders.

## 2. Commits and images

`39bf562` (v0.319.0) → `f30a808` (the work) → `1296e7a` (the FileBrowser line's link style, seen in the browser) →
this docs commit. Built from the clean clone with its own `build.sh`: `0.320.0-rc.1`, `rc.2` (demo-hp only), release
**0.320.0** (MinAgent 0.158.1).

## 3. What changed

- `web/app_page.go`: `installed = Deployed || Infra`; infra tabs settings/guide/logs; data tab and install page 302
  for infra; the settings tab skips the install form for infra and sets `LoginAnswer`.
- `web/handlers.go` (`appCommonData`): `Infra`, `InfraInfo`, the infra subdomain, `FilesLink`;
  `appFileBrowserResetHandler`. `web/server.go`: the reset route.
- `web/app_login.go`: `loginAnswerFor`. `web/datapath_card.go`: media folder rows, `drivePresent`, `filesButtonLink`,
  a folder with no source is text. `web/inframeta.go`: `infraMetaIn`.
- `stacks/filebrowser_password.go`: `ResetFileBrowserAdminPassword`, `fileBrowserCLISetPassword`.
  `stacks/deploy.go` + `api/router.go`: the protected-stack refusal. `stacks/metadata.go`: `AppInfo.LoginKind`,
  `EffectiveLoginKind`.
- Templates: `app_settings.html` (one login panel, infra Restart only), `app_shell.html` (infra tagline, „Fájlok ↗"),
  `app_data.html` (text rows, the FileBrowser line), `app_guide.html` (infra two lines); `style.css`.

## 4. Tests and gates

Red-proved: `TestAppPage_InfraAppHasNoInstall`, `_EveryInstalledAppHasOneLoginAnswer`, `_FilesButtonTarget`,
`_UnknownSourceIsTextNotLink`, `TestFileBrowserReset_SetsVerifiesAndStoresEncrypted`, `_FailedVerifyKeepsOperator`,
`_OnlyInOperatorState`, `TestDeployStack_RefusesProtectedStack` (mutations and failures: felhom.eu
`audits/logins-folders-2026-10-16/redproof.txt`). Also `TestFileBrowserResetEndpoint_Refusals`,
`TestEffectiveLoginKind_DefaultAndUnknown`. Green gate `go build/vet/test ./...` rc 0; `controller_gates.py --fast` all
OK. Parity fixtures: 25 re-captured, 6 new (named in the CHANGELOG); every other one byte-identical.

## 5. Observations

1. One sign-in for the dashboard and FileBrowser. FILED: R-1100.
2. FileBrowser's stored password goes stale when changed in FileBrowser. FILED: R-1101.
3. Eight apps say „starts with a known, shared password" about a generated or typed login. FILED: R-1102.
4. The install button could deploy a protected stack. NOT-A-FINDING: small, fixed in this release with a test.